<!DOCTYPE html>



  


<html class="theme-next gemini use-motion" lang="zh-Hans">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="theme-color" content="#222">









<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />
















  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />







<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />

<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css" />


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png?v=5.1.4">


  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">





  <meta name="keywords" content="逆向,内核," />










<meta name="description" content="前言本文简述的是x86处理器的分页机制。">
<meta property="og:type" content="article">
<meta property="og:title" content="保护模式：分页机制">
<meta property="og:url" content="http://liuyun000.gitee.io/2020/05/06/%E9%80%86%E5%90%91/%E4%BF%9D%E6%8A%A4%E6%A8%A1%E5%BC%8F%EF%BC%9A%E5%88%86%E9%A1%B5%E6%9C%BA%E5%88%B6/index.html">
<meta property="og:site_name" content="liuyun的博客">
<meta property="og:description" content="前言本文简述的是x86处理器的分页机制。">
<meta property="og:image" content="http://liuyun000.gitee.io/images/PDE_PTE.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/PDE_PTE_structure.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/2-9-9-12.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/PDPTE.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/XD_bit.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/TLB_structure.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/NonMaskable_Interrupt.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/Maskable_Interrupt.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/Exception.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/Cr0.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/Cr2.jpg">
<meta property="og:image" content="http://liuyun000.gitee.io/images/Cr4.jpg">
<meta property="article:published_time" content="2020-05-05T16:00:00.000Z">
<meta property="article:modified_time" content="2020-05-06T11:54:05.557Z">
<meta property="article:author" content="liuyun">
<meta property="article:tag" content="逆向">
<meta property="article:tag" content="内核">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://liuyun000.gitee.io/images/PDE_PTE.jpg">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Gemini',
    version: '5.1.4',
    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
    fancybox: true,
    tabs: true,
    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
    duoshuo: {
      userId: '0',
      author: '博主'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="http://liuyun000.gitee.io/2020/05/06/逆向/保护模式：分页机制/"/>





  <title>保护模式：分页机制 | liuyun的博客</title>
  








<meta name="generator" content="Hexo 4.2.0"></head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">

  
  
    
  

  <div class="container sidebar-position-left page-post-detail">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-wrapper">
  <div class="site-meta ">
    

    <div class="custom-logo-site-title">
      <a href="/"  class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">liuyun的博客</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
      
        <p class="site-subtitle"></p>
      
  </div>

  <div class="site-nav-toggle">
    <button>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />
            
            首页
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br />
            
            标签
          </a>
        </li>
      
        
        <li class="menu-item menu-item-categories">
          <a href="/categories/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-th"></i> <br />
            
            分类
          </a>
        </li>
      
        
        <li class="menu-item menu-item-archives">
          <a href="/archives/%20" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />
            
            归档
          </a>
        </li>
      

      
    </ul>
  

  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block">
    <link itemprop="mainEntityOfPage" href="http://liuyun000.gitee.io/2020/05/06/%E9%80%86%E5%90%91/%E4%BF%9D%E6%8A%A4%E6%A8%A1%E5%BC%8F%EF%BC%9A%E5%88%86%E9%A1%B5%E6%9C%BA%E5%88%B6/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="liuyun">
      <meta itemprop="description" content="">
      <meta itemprop="image" content="/images/avatar.gif">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="liuyun的博客">
    </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">保护模式：分页机制</h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              
                <span class="post-meta-item-text">发表于</span>
              
              <time title="创建于" itemprop="dateCreated datePublished" datetime="2020-05-06T00:00:00+08:00">
                2020-05-06
              </time>
            

            

            
          </span>

          
            <span class="post-category" >
            
              <span class="post-meta-divider">|</span>
            
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              
                <span class="post-meta-item-text">分类于</span>
              
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B/" itemprop="url" rel="index">
                    <span itemprop="name">逆向工程</span>
                  </a>
                </span>

                
                
              
            </span>
          

          
            
          

          
          

          

          

          

        </div>
      </header>
    

    
    
    
    <div class="post-body" itemprop="articleBody">

      
      

      
        <h3 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h3><p>本文简述的是x86处理器的分页机制。</p>
<a id="more"></a>

<h3 id="分页"><a href="#分页" class="headerlink" title="分页"></a>分页</h3><h4 id="分页-1"><a href="#分页-1" class="headerlink" title="分页"></a>分页</h4><ul>
<li><p>4GB内存空间</p>
<p>操作系统为每个进程虚拟4GB的虚拟内存（x86），CPU通过分页机制映射到物理内存。</p>
</li>
<li><p>物理地址</p>
<ul>
<li>线性地址、有效地址、物理地址</li>
</ul>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"># 如下指令：</span><br><span class="line">mov eax, dword ptr ds:[0x12345678]</span><br><span class="line"># 其中，0x12345678 是 有效地址</span><br><span class="line"># ds.Base + 0x12345678 是 线性地址</span><br></pre></td></tr></table></figure>
</li>
<li><p>10-10-12 分页</p>
<ul>
<li><p>就是虚拟地址的32位按照10位-10位-12位的方式分开</p>
</li>
<li><pre><code class="C"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span>

<span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>
<span class="function"></span>{
    <span class="keyword">const</span> <span class="keyword">char</span>* p = <span class="string">"Hello"</span>;
    <span class="built_in">printf</span>(<span class="string">"%p\n"</span>, p);
    getchar();
    <span class="keyword">return</span> <span class="number">0</span>;
}
<span class="comment">// Output: 00CE5740</span>
&lt;!--￼<span class="number">1</span>--&gt;
<span class="number">0000</span> <span class="number">0000</span> <span class="number">1100</span> <span class="number">1110</span> <span class="number">0101</span> <span class="number">740</span>
<span class="number">0000</span> <span class="number">0000</span> <span class="number">11</span>    <span class="number">0x3</span>
<span class="number">00</span> <span class="number">1110</span> <span class="number">0101</span>    <span class="number">0x0E5</span>
<span class="number">740</span>                <span class="number">0x740</span>
</code></pre>
</li>
</ul>
<p>3: kd&gt; !process 0 0<br>PROCESS 8769b1b8  SessionId: 1  Cid: 0e8c    Peb: 7ffdf000  ParentCid: 0cf8</p>
<pre><code>DirBase: 4d7c1000  ObjectTable: 91667e88  HandleCount:  21.
Image: bbb.exe</code></pre><p>0: kd&gt; !dd 4d7c1000+3<em>4 L1<br>#4d7c100c 4cbd9867<br>0: kd&gt; !dd 4cbd9000+e5</em>4 L1<br>#4cbd9394 4bfcc025<br>0: kd&gt; !db 4bfcc000+740 L10<br>#4bfcc740 48 65 6c 6c 6f 00 00 00-66 00 3a 00 5c 00 64 00 Hello…f.:..d</p>
<pre><code></code></pre></li>
</ul>
<h4 id="PDE-PTE"><a href="#PDE-PTE" class="headerlink" title="PDE PTE"></a>PDE PTE</h4><ul>
<li>80x86映射表分2级：<ul>
<li>第一级：页目录表（PDT）</li>
<li>第二级：页表（PTT）</li>
</ul>
</li>
<li><img src="/images/PDE_PTE.jpg" alt="PDE与PTE"></li>
</ul>
<h4 id="PDE-PTE属性"><a href="#PDE-PTE属性" class="headerlink" title="PDE PTE属性"></a>PDE PTE属性</h4><ul>
<li><p>物理页属性</p>
<ul>
<li>物理页属性 = PDE属性 &amp; PTE属性</li>
<li><img src="/images/PDE_PTE_structure.jpg" alt="PDE_PTE属性"></li>
</ul>
</li>
<li><p>P位</p>
<p>P位为1是有效的物理页</p>
</li>
<li><p>R/W</p>
<ul>
<li>R/W = 0 只读</li>
<li>R/W = 1 可读可写</li>
</ul>
</li>
<li><p>U/S</p>
<ul>
<li>U/S = 0 只有特权用户才能访问</li>
<li>U/S = 1 普通用户也能访问</li>
</ul>
</li>
<li><p>P/S位</p>
<ul>
<li>只对PDE有意义，PS == PageSize的意思，当PS == 1的时候，PDE直接指向物理页，无PTE，低22位是页偏移。此时线性地址只能拆成2段：大小为4MB，俗称大页。</li>
</ul>
</li>
<li><p>A位</p>
<ul>
<li>是否被访问（读或者写）过，访问过置1，只访问一个字节也会导致PDE PTE置1</li>
</ul>
</li>
<li><p>D位</p>
<ul>
<li>脏位 是否被写过 0没有被写过 1被写过</li>
</ul>
</li>
<li><p>Avail</p>
<ul>
<li>交给操作系统使用，其意义由操作系统决定。</li>
</ul>
</li>
</ul>
<h4 id="页目录表基址"><a href="#页目录表基址" class="headerlink" title="页目录表基址"></a>页目录表基址</h4><ul>
<li>虚拟地址的C0300000就是页目录表的基址。要访问第N个PDE，有公式：<code>0xC0300000+N*4</code></li>
<li>总结<ul>
<li>通过0xC0300000找到的物理页就是页目录表</li>
<li>这个物理页即使页目录表，本身也是页表</li>
<li>页目录表是一张特殊的页表，每一项PTE指向的不是普通的物理页，而是指向其他的页表</li>
<li>如果要访问第N个PDE，有公式：<code>0xC0300000+N*4</code></li>
</ul>
</li>
</ul>
<h4 id="页表基址"><a href="#页表基址" class="headerlink" title="页表基址"></a>页表基址</h4><ul>
<li>页表被应劭到了从0xC0000000到0xC03FFFFF的4M地址空间</li>
<li>再这1024个表中有一张特殊的表：页目录表</li>
<li>页目录表被映射到了0xC0300000开始处的4K地址。</li>
<li>公式总结：<ul>
<li>什么是PDI与PTI<ul>
<li>10-10-12，前两个10分别是PDI和PTI</li>
</ul>
</li>
<li>访问页目标表的公式：<code>0xC0300000 + PDI*4</code></li>
<li>访问页表的公式：<code>0XC0000000 + PDI*4096+PTI*4</code></li>
</ul>
</li>
</ul>
<h4 id="2-9-9-12分页"><a href="#2-9-9-12分页" class="headerlink" title="2-9-9-12分页"></a>2-9-9-12分页</h4><p>随着硬件发展，4GB的物理地址范围已经无法满足要求，Intel再1996年已经意识都这个问题了，所以设计了新的分页方式，也就是2-9-9-12分页，又称PAE（物理地址扩展）分页。</p>
<p><img src="/images/2-9-9-12.jpg" alt="2-9-9-12分页"></p>
<ul>
<li>Page-Directory-Point-Table Entry<ul>
<li><img src="/images/PDPTE.jpg" alt="PDPTE结构"></li>
</ul>
</li>
<li>PDE结构<ul>
<li>大致和10-10-12分页相仿，改变如下<ul>
<li>每项扩展成了8字节</li>
<li>第12位在大页情况下为PAT</li>
</ul>
</li>
<li>当PS = 1时是大页，21-35位为大页的物理地址，低21位补0，页大小为2M，且都是2M对齐</li>
<li>当PS = 0时是小页，35-12位是页表基址，低12位补0，共36位。</li>
</ul>
</li>
<li>PTE结构<ul>
<li>大致和10-10-12分页相仿，只不过每项扩展成了8字节，35-12是物理页基址，24位，低12位补0，物理页基址+12位页内偏移指向具体数据。</li>
</ul>
</li>
<li>XD标志位（AMD中称为NX，即No Excetion）<ul>
<li>PDE/PTE结构<ul>
<li><img src="/images/XD_bit.jpg" alt="PDE/PTE结构"></li>
</ul>
</li>
<li>页的可执行属性，XD=1时不可执行。</li>
</ul>
</li>
</ul>
<h4 id="TLB"><a href="#TLB" class="headerlink" title="TLB"></a>TLB</h4><ul>
<li><p>地址解析</p>
<ul>
<li>通过一个线性地址访问一个物理页。比如：一个DWORD，其实未必真正读的时4个字节，我们先读的PDE再读PTE，最后才读的4个字节的页。</li>
<li>在2-9-9-12会读24个字节，如果跨页可能更多。</li>
<li>为了提高效率，只能做记录</li>
<li>CPU内部做了一个表，来记录这些东西，这个表格是CPU内部的，和寄存器一样快，这个表格：TLB（Translation Lookaside Buffer）</li>
</ul>
</li>
<li><p>TLB结构</p>
<ul>
<li><img src="/images/TLB_structure.jpg" alt="TLB结构"></li>
<li>说明：<ul>
<li>ATTR（属性）：属性是PDPE PDE PTE三个属性AND起来的，如果是10-10-12就是PDE and PTE</li>
<li>不同的CPU这个表的大小不一样</li>
<li>只要Cr3变了，TLB立马刷新，一核一套TLB</li>
</ul>
</li>
<li>操作系统的高2G映射基本不变，如果Cr3改了，TLB刷新，重建2G以上很浪费。所以PDE和PTE中有个G标志位，如果G位为1刷新TLB时将不会刷新PDE/PTE的G位为1的页，当TLB满了，根据统计信息将不常用的地址废弃，最近最常用的保留</li>
</ul>
</li>
<li><p>TLB种类</p>
<p>TLB在X86体系的CPU里的实际应用最早是从Intel的486CPU开始的，在x86体系的CPU里面，一般都设有如下4组TLB：</p>
<ul>
<li>第一组：缓存一般页表（4K字节页面）的指令页表缓存（Instruction-TLB）</li>
<li>第二组：缓存一般页表（4K字节页面）的数据页表缓存（Date-TLB）</li>
<li>第三组：缓存大尺寸页表（2M/4M字节页面）的指令页缓存（Instruction-TLB）</li>
<li>第四组：缓存大尺寸页表（2M/4M字节页面）的数据页表缓存</li>
</ul>
</li>
</ul>
<h4 id="中断与异常"><a href="#中断与异常" class="headerlink" title="中断与异常"></a>中断与异常</h4><ul>
<li><p>什么是中断</p>
<ul>
<li>中断通常是由CPU外部的输入输出设备（硬件）所触发的，供外部设备通知CPU“有事情需要处理”，因此又叫中断请求（Interrupt Request）</li>
<li>中断请求的目的是希望CPU暂时停止当前正在执行的程序，砖砌执行中断请求所对应的中断处理例程（中断处理程序在哪由IDT表决定）</li>
<li>80x86有两条中断请求线：<ul>
<li>非屏蔽中断线，称为NMI（NonMaskable Interrupt）</li>
<li>可凭不中断线，称为INTR（Interrupt Request）</li>
</ul>
</li>
</ul>
</li>
<li><p>非可屏蔽中断如何处理</p>
<ul>
<li><img src="/images/NonMaskable_Interrupt.jpg" alt="非可屏蔽中断"></li>
<li>当非可屏蔽中断产生时，CPU在执行完当前指令后会立马进入中断处理程序</li>
<li>非可屏蔽中断不受EFLAGS寄存器中IF位的影响，一旦发生，CPU必须处理</li>
<li>非可屏蔽中断处理程序位于IDT表中的2号位置</li>
</ul>
</li>
<li><p>可屏蔽中断</p>
<ul>
<li>在硬件级，可屏蔽中断时由一块专门的芯片来管理的，通常称为中断控制器。它负责分配中断资源和管理各个中断源发出的中断请求。为了便于识别各个中断请求，中断管理器通常同IRQ（Interrupt Request）后面加上数字来表示不同的中断。</li>
<li>比如在Windows中时钟的中断的IRQ编号为0，也就是：IRQ0</li>
</ul>
</li>
<li><p>如何处理可屏蔽中断</p>
<ul>
<li><img src="/images/Maskable_Interrupt.jpg" alt="可屏蔽中断"></li>
<li>如果自己的程序执行时不希望CPU去处理这些中断，可以<ul>
<li>用CLI指令清空EFLAGS寄存器中的IF位</li>
<li>用STI指令设置EFLAGS寄存器中的IF位</li>
</ul>
</li>
<li>硬件中断与IDT表中的对应关系并非固定不变的。</li>
</ul>
</li>
<li><p>异常</p>
<p>异常通常是CPU在执行指令时检测到的某些错误，比如除0、访问无效页面等。</p>
<p>中断与异常的区别：</p>
<ul>
<li>中断来自于外部设备，是中断源（比如键盘）发起的，CPU是被动的</li>
<li>异常来自于CPU本身，是CPU主动产生的</li>
<li><code>INT N</code>虽然被称为“软中断”，但其本质是异常，EFLAGS的IF位对<code>INT N</code>无效</li>
</ul>
</li>
<li><p>异常处理</p>
<ul>
<li><p>无论是由硬件设备出发的中断请求还是由CPU产生的异常，处理程序都在IDT表。</p>
</li>
<li><p>常见的异常处理程序：</p>
<p><img src="/images/Exception.jpg" alt="异常"></p>
</li>
</ul>
</li>
</ul>
<h4 id="控制寄存器"><a href="#控制寄存器" class="headerlink" title="控制寄存器"></a>控制寄存器</h4><ul>
<li><p>控制寄存器</p>
<p>控制寄存器用于控制和确定CPU的操作模式。</p>
<ul>
<li>Cr0 Cr1 Cr2 Cr3 Cr4</li>
<li>Cr1 保留</li>
<li>Cr3 页目录表基址</li>
</ul>
</li>
<li><p>Cr0寄存器</p>
<ul>
<li><p><img src="/images/Cr0.jpg" alt="Cr0寄存器"></p>
</li>
<li><p>PE: Cr0 的位0 是启用保护（Protection Enable）标志</p>
<ul>
<li>PE = 1 保护模式  PE = 0 实地址模式 这个标志仅开启段级保护，并没有启动分页基址。若启用分页机制，那么PE和PG标志都要置位。</li>
</ul>
</li>
<li><p>PG：当设置该位时开启了分页机制。在开启这个标志位之前必须已经或者同时开启PE标志。</p>
</li>
<li><p>WP：对于Intel 80486或以上的CPU，Cr0的位16是写保护（Write Protect）标志。当设置该标志时，处理器会进制超级用户程序（例如特权级0的程序）向用户级只读页面执行写操作：</p>
<p>当CPL &lt; 3 的时候：</p>
<ul>
<li>如果WP = 0可以读写任意用户级物理页，只要线性地址有效</li>
<li>如果WP=1可以读取任何用户级物理页，但对于只读的物理页，则不能写。</li>
</ul>
</li>
</ul>
</li>
<li><p>Cr2寄存器</p>
<ul>
<li><img src="/images/Cr2.jpg" alt="Cr2寄存器"></li>
<li>当CPU访问某个无效页面时，会产生缺页异常，此时，CPU会将引起异常的线性地址存放在Cr2中。</li>
</ul>
</li>
<li><p>Cr4寄存器</p>
<ul>
<li><p><img src="/images/Cr4.jpg" alt="Cr4寄存器"></p>
</li>
<li><p>PAE = 1 是 2-9-9-12分页，PAE=0是10-10-12分页。</p>
</li>
<li><p>PSE = 1</p>
<ul>
<li><p>10-10-12 </p>
<table>
<thead>
<tr>
<th>PS = 1</th>
<th>4M页</th>
</tr>
</thead>
<tbody><tr>
<td>PS = 0</td>
<td>4K页</td>
</tr>
</tbody></table>
</li>
<li><p>2-9-9-12</p>
<table>
<thead>
<tr>
<th>PS = 1</th>
<th>2M页</th>
</tr>
</thead>
<tbody><tr>
<td>PS=0</td>
<td>4K页</td>
</tr>
</tbody></table>
</li>
</ul>
</li>
<li><p>PSE = 0</p>
<ul>
<li><p>10-10-12</p>
<table>
<thead>
<tr>
<th>PS = 1</th>
<th>4K页</th>
</tr>
</thead>
<tbody><tr>
<td>PS = 0</td>
<td>4K页</td>
</tr>
</tbody></table>
</li>
<li><p>2-9-9-12</p>
<table>
<thead>
<tr>
<th>PS = 1</th>
<th>4K页</th>
</tr>
</thead>
<tbody><tr>
<td>PS = 0</td>
<td>4K页</td>
</tr>
</tbody></table>
</li>
</ul>
</li>
</ul>
</li>
<li><p>更多参考Intel白皮书</p>
</li>
</ul>
<h4 id="PWT-PCD"><a href="#PWT-PCD" class="headerlink" title="PWT/PCD"></a>PWT/PCD</h4><ul>
<li>CPU缓存<ul>
<li>CPU缓存是位于CPU与物理内存之间的临时存储器，它的容量比内存小得多但是交换速度却比内存要快得多</li>
<li>CPU缓存可以做得很大，有几K、几十K、几百K甚至上M的也有</li>
<li>CPU缓存与TLB的区别：<ul>
<li>TLB： 线性地址  &lt;—–&gt; 物理地址</li>
<li>CPU缓存： 物理地址 &lt; – – &gt; 内容</li>
</ul>
</li>
</ul>
</li>
<li>关于PWT/PCD属性<ul>
<li>PWT: Page Write Through<ul>
<li>PWT = 1时，写Catch的时候也要将数据写入内存中</li>
</ul>
</li>
<li>PCD: Page Cache Disable<ul>
<li>PCD = 1时，进制某个页写入缓存，直接写内存</li>
<li>比如，做页表用的页，已经存储在TLB中了，可能不需要再缓存了。</li>
</ul>
</li>
</ul>
</li>
</ul>

      
    </div>
    
    
    

    

    

    

    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/%E9%80%86%E5%90%91/" rel="tag"># 逆向</a>
          
            <a href="/tags/%E5%86%85%E6%A0%B8/" rel="tag"># 内核</a>
          
        </div>
      

      
      
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2020/04/22/%E9%80%86%E5%90%91/windbg%20reload%E6%97%A0%E6%B3%95%E4%B8%8E%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%BB%BA%E7%AB%8B%E8%BF%9E%E6%8E%A5/" rel="next" title="windbg .reload时无法与服务器建立连接">
                <i class="fa fa-chevron-left"></i> windbg .reload时无法与服务器建立连接
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
          </div>
        </div>
      

      
      
    </footer>
  </div>
  
  
  
  </article>



    <div class="post-spread">
      
    </div>
  </div>


          </div>
          


          

  



        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
            文章目录
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
            站点概览
          </li>
        </ul>
      

      <section class="site-overview-wrap sidebar-panel">
        <div class="site-overview">
          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
            
              <p class="site-author-name" itemprop="name">liuyun</p>
              <p class="site-description motion-element" itemprop="description"></p>
          </div>

          <nav class="site-state motion-element">

            
              <div class="site-state-item site-state-posts">
              
                <a href="/archives/%20%7C%7C%20archive">
              
                  <span class="site-state-item-count">16</span>
                  <span class="site-state-item-name">日志</span>
                </a>
              </div>
            

            
              
              
              <div class="site-state-item site-state-categories">
                <a href="/categories/index.html">
                  <span class="site-state-item-count">9</span>
                  <span class="site-state-item-name">分类</span>
                </a>
              </div>
            

            
              
              
              <div class="site-state-item site-state-tags">
                <a href="/tags/index.html">
                  <span class="site-state-item-count">21</span>
                  <span class="site-state-item-name">标签</span>
                </a>
              </div>
            

          </nav>

          

          

          
          

          
          

          

        </div>
      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-3"><a class="nav-link" href="#前言"><span class="nav-number">1.</span> <span class="nav-text">前言</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#分页"><span class="nav-number">2.</span> <span class="nav-text">分页</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#分页-1"><span class="nav-number">2.1.</span> <span class="nav-text">分页</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#PDE-PTE"><span class="nav-number">2.2.</span> <span class="nav-text">PDE PTE</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#PDE-PTE属性"><span class="nav-number">2.3.</span> <span class="nav-text">PDE PTE属性</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#页目录表基址"><span class="nav-number">2.4.</span> <span class="nav-text">页目录表基址</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#页表基址"><span class="nav-number">2.5.</span> <span class="nav-text">页表基址</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#2-9-9-12分页"><span class="nav-number">2.6.</span> <span class="nav-text">2-9-9-12分页</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#TLB"><span class="nav-number">2.7.</span> <span class="nav-text">TLB</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#中断与异常"><span class="nav-number">2.8.</span> <span class="nav-text">中断与异常</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#控制寄存器"><span class="nav-number">2.9.</span> <span class="nav-text">控制寄存器</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#PWT-PCD"><span class="nav-number">2.10.</span> <span class="nav-text">PWT&#x2F;PCD</span></a></li></ol></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright">&copy; <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">liuyun</span>

  
</div>


  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>



  <span class="post-meta-divider">|</span>



  <div class="theme-info">主题 &mdash; <a class="theme-link" target="_blank" href="https://github.com/iissnan/hexo-theme-next">NexT.Gemini</a> v5.1.4</div>




        







        
      </div>
    </footer>

    
      <div class="back-to-top">
        <i class="fa fa-arrow-up"></i>
        
      </div>
    

    

  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  












  
  
    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
  

  
  
    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
  

  
  
    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
  


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>



  
  


  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>

  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>



  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.4"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.4"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>



  


  




	





  





  












  





  

  

  

  
  

  

  

  

<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginModelPath":"assets/","model":{"jsonPath":"/live2dw/assets/miku.model.json"},"display":{"position":"right","width":150,"height":300},"mobile":{"show":false},"log":false,"pluginJsPath":"lib/","pluginRootPath":"live2dw/","tagMode":false});</script></body>
</html>
